CVE-2026-101650 is a vulnerability in Oracle Partner Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data and causing a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts on integrity and availability.
CVE-2026-101649 is a vulnerability in Oracle Partner Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTPS to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical data and partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts on integrity and availability.
CVE-2026-101648 is a high-severity vulnerability in Oracle Partner Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-101606 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows an unauthenticated attacker with network access via TLS to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with impacts on confidentiality and integrity but no impact on availability. Oracle has released a Critical Patch Update that addresses this and many other vulnerabilities, and customers are strongly advised to apply the patches promptly.
CVE-2026-101605 is a medium severity vulnerability in Oracle Utilities Network Management System allowing an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to some accessible data. The vulnerability affects multiple specific versions of the product. The CVSS 3.1 base score is 5.3, indicating a confidentiality impact without integrity or availability impact. Oracle has published a Critical Patch Update advisory including patches for this and other vulnerabilities.
CVE-2026-101604 is a high-severity vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or potentially all accessible data within the product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.
CVE-2026-101603 is a high-severity vulnerability in Oracle Communications Unified Inventory Management affecting versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with network access via HTTP to potentially take over the product. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.5. Oracle has published a Critical Patch Update advisory that includes patches addressing this and many other vulnerabilities.
CVE-2026-101602 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. Exploitation requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.0. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-101596 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low-privileged attacker with network access via HTTP to fully compromise the affected product, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.
CVE-2026-101595 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Successful exploitation requires user interaction from someone other than the attacker and may impact additional Oracle products beyond the initial scope. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts.
CVE-2026-101594 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches addressing this and other vulnerabilities are available.
CVE-2026-101593 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.3, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-101592 is a medium severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Successful exploitation requires user interaction from someone other than the attacker and may impact additional Oracle products beyond the initial scope. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting limited confidentiality and integrity impacts without availability impact.
CVE-2026-101591 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data within the product. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-101589 is a vulnerability in Oracle Utilities Network Management System that allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to some accessible data. The affected versions include 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0.0 through 25.12.0.0.2. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has released a Critical Patch Update that includes patches for this and many other vulnerabilities, and customers are strongly advised to apply these patches promptly.
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101545 is a vulnerability in Oracle Inventory Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where Oracle Inventory Management runs to compromise the product. Successful exploitation can lead to full takeover of Oracle Inventory Management. The vulnerability has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101538 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle Order Management. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101536 is a vulnerability in Oracle Cost Management, part of the Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to potentially take over Oracle Cost Management. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101529 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability affects versions 13.5 and 24.1. The CVSS 3.1 base score is 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this flaw may also impact additional Oracle products due to scope change. Oracle has released patches addressing this vulnerability in their October 2026 Critical Patch Update.